Hey@Kozokkon, You can try using summary indexing but this can be done after indexing data for the first time. http://docs.splunk.com/Documentation/Splunk/7.1.1/Knowledge/Usesummaryindexing Let me know if this helps!! ... View more

Hey@ Oracle, Try comparing the props.conf and transforms.conf on both the Search Heads.This should help you find where the problem is. You can use btool on both the search heads for comparison. Let me know if this helps!! ... View more

Hey alessionazio, You can reset your password. Refer this accepted answer: https://answers.splunk.com/answers/834/how-to-reset-the-admin-password.html Let me know if this helps!! ... View more

Hey rndp89, You can refer this link: https://answers.splunk.com/answers/521464/how-to-run-multiple-universal-forwarders-on-a-sing.html Let me know if this helps!! ... View more

Hi venkatsm, I am not sure how much this will help but you can try using join and also fields like date_wday and date_hour for your comparison. Also refer this blog for timewrap: https://www.splunk.com/blog/2013/12/04/comparing-week-over-week-results.html Let me know if this helps!! ... View more

Hey criedman, You can try something like this: index="xxx" source="xxx" |eval currenttime=now() |eval a=currenttime-36000 |search datetimefield >a In this case,you will be comparing the currenttime-10mins which gives a in epoch of 10 mins earlier.Also please make sure you convert the datetimefield in epoch as well. Let me know if this works!! ... View more

Hey @weicheng98, You can try using this app : https://splunkbase.splunk.com/app/3606/#/details Let me know if this helps!! ... View more

Hey@MuS, What permission does the file require for destructive input? ... View more

Hey @tomaszwrona, Can you try referring this link: https://docs.splunk.com/Documentation/Splunk/7.1.0/AdvancedDev/TranslateSplunk#Translate_Apps Let me know if this helps!! ... View more

Hey@david_resnick, Can you try restarting splunkd service ... View more

Hey@funlearning321, The answer is no , that path won't be monitored. Hope this helps!! ... View more

Hey @ Mayanakhan, Refer this link: http://docs.splunk.com/Documentation/Splunk/7.1.0/DistSearch/Addaclustermember Let me know if this helps!! ... View more

Hey@kedjjang, Refer this answer: https://answers.splunk.com/answers/42495/unable-to-distribute-to-peer-adjustable-timeout.html Let me know if this helps!! ... View more

Hey @ kienqn, What is the role that you are using? If you have just installed splunk and have role as admin the initial password is changeme. Let me know if this helps!! ... View more

Hey Arjit, You can see Dynatrace as the solution that collects all the performance relevant data from your end-users. From Browser to the Database - down to the method level. Dynatrace has a lot of capabilities to analyze this data - including automatic baselining and alerting. Dynatrace is not competing with Splunk - it is complementary. Dynatrace can feed data into Splunk and you can then use Splunk for Business Intelligence briding multiple datasources. Refer this link: https://www.dynatrace.com/technologies/integration/splunk/ I hope this is what you needed. Let me know if this helps!! ... View more

Hey jadengoho, Have you added pycrypto package ? Refer the steps in this link: https://splunkbase.splunk.com/app/1537/#/details Let me know if this helps!! ... View more

Hey khanlarloo, Can you test this command and check if you get results: snmpwalk -v3 -u user -l authPriv -a auth -A pass -x AES -X pass -m +F5-BIGIP-LOCAL-MIB F5_IP ltmPoolMemberMonitorStatus Also below are the pre-requisites: Deploy Lookup File Editor (https://splunkbase.splunk.com/app/1724/) on your Splunk Search Head. Snmpwalk (SNMP) must be available from the Splunk instance that will run the SNMP poller. As using snmpwalk through shell scripts, this Splunk instance must be hosted on a Linux system. Refer this link: https://splunkbase.splunk.com/app/3857/#/details Let me know if this helps!! ... View more

Hi katouoma, Can you try using round instead: eval perc_err_test2 = round((Error_test2 / TOTAL) 100,4) ." %" Let me know if this helps!! ... View more

Hey@bgagliardi1, Following are the options to consider: http://docs.splunk.com/Documentation/Splunk/7.0.3/Knowledge/Aboutsummaryindexing 1. Use base search to run searches. 2. Use loadjob searches https://docs.splunk.com/Documentation/Splunk/7.0.3/SearchReference/Loadjob 3. Use accelerated reports 4. Use data-model acceleration http://docs.splunk.com/Documentation/Splunk/7.0.3/Knowledge/Acceleratedatamodels 5. Make sure you add filters in the start of the search. 6. Use Summary indexing http://docs.splunk.com/Documentation/Splunk/7.0.3/Knowledge/Usesummaryindexing http://docs.splunk.com/Documentation/Splunk/7.0.3/Knowledge/Configurebatchmodesearch Let me know if this helps!! ... View more

Is the error still the same or error is different? ... View more

Splunk Enterprise Security app license has to be purchased seperately along with Splunk Enterprise and the validity and license you can check in your licensing section on Splunk. ... View more

Hey@mailmetoramu, Splunk Enterprise Security is a paid app which is installed on Splunk Enterprise.For implementation purpose you need to contact Splunk with your exact requirement for further guidance. Refer this link: https://splunkbase.splunk.com/app/263/ https://www.splunk.com/en_us/products/premium-solutions/splunk-enterprise-security/features.html Let me know if this helps!! ... View more

Hey LordLeet, Are you trying something like this: source=sourceA OR source=sourceB OR source=sourceC | stats values(fielda1) AS fielda1 values(fielda2) AS fielda2 values(fieldb1) AS fieldb1 values(fieldc1) AS fieldc1 values(id_field1) AS id_field1 values(id_field2) AS id_field1 by _time Let me know if this helps!! ... View more

Hey@davidcraven02, You need to check the following points: 1. Was the app being pushed on the hosts from which data is not coming?ie, the app having inputs.conf. 2. Check if any error are coming in index=_internal for that particular host if not sending data. 3. Check if the followtail logs are coming in _internal for those particular host. 4. If all these conditions are satisfied then your problem has to be crc_salt , Removing crc_salt should solve this but might also re-index the data which is already indexed. 5. Also you can check initCrcLength for the issue. Refer this link: http://docs.splunk.com/Documentation/Splunk/7.0.2/Data/Howlogfilerotationishandled Let me know if this helps!! ... View more